32-bit
exeuser scopewww.sumatrapdfreader.org · publisher domain- File name
- SumatraPDF-3.6.1-install.exe
- SHA-256
- e232308a77e2293bafe4ac4079ddb8ef00ca10de43b9477ca55f17a03419770b
- Silent install
- -s
by Krzysztof Kowalczyk · GPL-3.0
SumatraPDF is a multi-format (PDF, EPUB, MOBI, CBZ, CBR, FB2, CHM, XPS, DjVu) reader for Windows.
These URLs are the ones Krzysztof Kowalczyk declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Krzysztof Kowalczyk published. Delete it.
Windows · PowerShell
Get-FileHash "SumatraPDF-3.6.1-64-install.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "SumatraPDF-3.6.1-64-install.exe"Expected output
1eee71cccd2ea6e94d5bcea54ee2f759844da3e1a0ee2f6045035b1d17b94381
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Krzysztof Kowalczyk declares in the installer manifest, not one we guessed by trying flags.
32-bit · user scope · publisher-declared
.\SumatraPDF-3.6.1-install.exe -s64-bit · user scope · publisher-declared
.\SumatraPDF-3.6.1-64-install.exe -sARM64 · user scope · publisher-declared
.\SumatraPDF-3.6.1-arm64-install.exe -sRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 6 of 6 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 6 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 6 of 6 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 4 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions SumatraPDF registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from sumatrapdfreader.org, which is a domain we have tied to Krzysztof Kowalczyk.
Every one of the 6 installers on this page comes with the SHA-256 Krzysztof Kowalczyk declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id SumatraPDF.SumatraPDF --exactUpgrade later
winget upgrade --id SumatraPDF.SumatraPDFWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of SumatraPDF, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
810183F4F89DA182639D7C30F529242DF6C2C6444697790806DB50B0E14BEE54
2B52F4F66EA2229A431A434FCD608210C019D85FE67D06302F6544F63D66B319
E638173E0424F509FCBD2F7165CDDF1322E5FD0DC511DBBE9F51B9C4C6E220FB
DAA8397FD418430A9E6181772E8B7EFF3CDE89B9BE4286979ECFA5AC1967B71E
D820BC66D4E9935F725A141F58584352B84FFAEBBE5804B19201C94AB1BA1078
5FF0F4A2970E51D589BBA7490A98D96B5B4C868252984699631C6307A391A8E2
2BE4A27B83830EA07C6671C3557673D509544E5F70FC6B2DC8CC4388B302C1F2
66ccb395c9184dce6822dfbb9970c877383b3ead6d9417b5106a844aac512989
65B514E80E5121D5EC94705B4A94ADF3BF8A6EB6DE58D2707DDD72C3D6D3779D
5f1f460ff72ddd48979dbcfc2d427d53a473d43e18425470c78e94b19fee70b6
8F600E51AA574A424D0263C6C38AABF3F1E24F59AC8ECC26448DE33D24F8CC53
d6fa6678f3dd3017515faa74735ecbf860cb6825bd61f109f9157f0b171e882f
2E2C497BB750A590EF5333BEB909CFB9F38B6BC227AFA5F45262451146D919A6
14C2F82C677C501F63F1BE7493964C382A2409574FD707DBD2F274C3E64E0F95
3122DB60F5804FBF8B92EB86CBC3320A5853285E90AE1B473923C180D35BFE87
99B37AE1DFF6B9CEDE6BFC54A2473BE3D8E267A700F181835261612AA0F65EAF
8A9FDE1B2590A5DDBFBA27C07291AA91D17A3F20E5FD982EC78C1AB65774795E
96C0811ED79024150D6BC6E3F99B8EABF789111799E6BA62031CF93233FDFEB6
AA79391C7DB478FBB969875DA39CE09E3E8124B869ACC3178F5B6A3B4E10D5CE
10589651A77241BE7C12A065F32E52E7DB37AEB1E51EEAD6217D5EE6F50C86E2
79C7A79BB5E0B4CF67EF1475F38DED05C9E2C4537ADDEE5DFF2723BB98F4D52D
97C8A1EE3CED2CE708538F6E0C0B162BDB9F5E6F1B21987BCCFBBD23B22E4427
5C4751464AE77DCD0B99A8216718679BA2CAE860FC7EFEA834003842A443F150
BA5AA41DFD9F12B6F3FC3BFF66CE3D4B2B9944E9AE37B0DD653CFB0ADB6CDF39
C5A38B34E369233369919167DF5689EDA7E5874CFC3E6A0BB490CB71E09C9135
08512864E092805DE59ABF3914804BBA6464523BB161F0BF89C6480D944A6250
CB1D73323D3D80004ADA185844B0D461ABD9DED736D5DC690607F935B4F2B58A
E4801235DEFDF5AE7C5E384D45AE867E7993BD5EFC53CE26CE7DF24A8065180B
BAC85B28CBCFC04788E4420A0A51D71675890A47A17770AE76034BA53596A0AE
E0126C45E7F8F28EC0EBE8821A3FE4BAA09909F915C8E8F3B72A0ABB16672EF2
CCD808BB5B924C9FC70BB4FF0FAD3F74AED711B0BAA8784E60AE644549A41B55
8B908A69506860D892E918407349E516F5AF6B39BE7CECC812B91235D7B6B877
989310DB119AFC4C097BEB58FD3F3B69127FF2407367211CD1500E039E3EDA2B
AA20D0C676FBD091B119075B7952214EE9339773E3FA014406E4411B638DC83E
36D95DADF36CEAE35F49BA0DFF47FF628E3433B1150FB5A845F646BE67F90198
896166F4C56BD25A8AC49DE6A57A82CDD2D21073914ADCED3BB33E161F070DDE
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every SumatraPDF version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Krzysztof Kowalczyk and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to SumatraPDF — just other entries, each with its own official URL and published hash.